@mtndev/cli 2.0.0 → 2.0.1

package/cjs/__chunks/AZEB4H4I.cjs

@@ -1,208 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
-
-var _WHGN5PZIcjs = require('./WHGN5PZI.cjs');
-
-
-var _NLKJIUEXcjs = require('./NLKJIUEX.cjs');
-
-
-var _KU76LC42cjs = require('./KU76LC42.cjs');
-
-
-var _N5MXFOQZcjs = require('./N5MXFOQZ.cjs');
-
-
-var _LXOOJR2Rcjs = require('./LXOOJR2R.cjs');
-
-
-var _LHE24ECKcjs = require('./LHE24ECK.cjs');
-
-
-var _2FSYDFUVcjs = require('./2FSYDFUV.cjs');
-
-
-var _WBOQ6AUNcjs = require('./WBOQ6AUN.cjs');
-
-
-var _TKNNDDIBcjs = require('./TKNNDDIB.cjs');
-
-// src/commands/aws/index.js
-function collect(value, previous) {
-  return [...previous, value];
-}
-function registerAwsCommands(program) {
-  const aws = program.command("aws").summary("AWS operational commands (IAM, EC2, SES, Route53)").description("AWS operational commands for IAM, EC2, SES, and Route53");
-  const iam = aws.command("iam").summary("IAM ACL group and user management").description("IAM ACL group and user management");
-  iam.command("setup-acl").summary("Create ACL groups, policies, and (optionally) users").description(
-    "Idempotently create the ACL groups and managed policies, attach them per group, and optionally create IAM users."
-  ).option(
-    "--restrict-regions <yes|no>",
-    "Attach the region restriction to acl-power-users (skips the prompt)"
-  ).option(
-    "--no-create-users",
-    "Skip IAM user creation after configuring groups"
-  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
-    await _LHE24ECKcjs.setupAclCommand.call(void 0, {
-      restrictRegions: options.restrictRegions,
-      createUsers: options.createUsers,
-      profile: options.profile,
-      region: options.region,
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-  iam.command("users").summary("Interactively create IAM users and assign ACL groups").description(
-    "Interactively create md-{identifier}-{account}-{role} IAM users, assign ACL groups, and print CLI setup commands."
-  ).option(
-    "--account-name <slug>",
-    "AWS account slug used in md-{identifier}-{account}-{role}"
-  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
-    await _LXOOJR2Rcjs.usersCommand.call(void 0, {
-      accountName: options.accountName,
-      profile: options.profile,
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-  iam.command("check-admin").summary("Alert if anyone is in acl-admin-do-not-use").description(
-    "Scan one profile (--profile or AWS_PROFILE) or all aws-vault profiles (--all) for members of the break-glass acl-admin-do-not-use group."
-  ).option(
-    "-p, --profile <profile>",
-    "Operate on this profile (defaults to AWS_PROFILE)"
-  ).option(
-    "--all",
-    "Scan every aws-vault profile (default when no profile is set)"
-  ).option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
-    await _NLKJIUEXcjs.checkAdminCommand.call(void 0, {
-      profile: options.profile,
-      all: _nullishCoalesce(options.all, () => ( false)),
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-  iam.command("remove-admin").summary("Remove users from the acl-admin-do-not-use group").description(
-    "Remove break-glass admin access by removing users from acl-admin-do-not-use, for one profile (--profile or AWS_PROFILE) or every aws-vault profile (--all)."
-  ).option(
-    "-p, --profile <profile>",
-    "Operate on this profile (defaults to AWS_PROFILE)"
-  ).option(
-    "--all",
-    "Scan every aws-vault profile (default when no profile is set)"
-  ).option(
-    "--user <name>",
-    "Only remove this user (repeatable); default removes all",
-    collect,
-    []
-  ).option("-y, --yes", "Skip the per-profile confirmation prompt").option("--dry-run", "Preview removals without changing anything").option("-v, --verbose", "Show skipped profiles and detailed errors").action(async (options) => {
-    await _N5MXFOQZcjs.removeAdminCommand.call(void 0, {
-      profile: options.profile,
-      all: _nullishCoalesce(options.all, () => ( false)),
-      user: _nullishCoalesce(options.user, () => ( [])),
-      yes: _nullishCoalesce(options.yes, () => ( false)),
-      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-  iam.command("break-glass").summary("Grant break-glass admin access (acl-admin-do-not-use)").description(
-    "Grant break-glass AdministratorAccess by adding a user to acl-admin-do-not-use for one profile. Defaults to your own IAM user."
-  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
-    "--user <name>",
-    "Grant to this user (repeatable); default is your own IAM user",
-    collect,
-    []
-  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the grant without changing anything").option("-v, --verbose", "Show detailed errors").action(async (options) => {
-    await _KU76LC42cjs.breakGlassCommand.call(void 0, {
-      profile: options.profile,
-      user: _nullishCoalesce(options.user, () => ( [])),
-      yes: _nullishCoalesce(options.yes, () => ( false)),
-      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-  const ec2 = aws.command("ec2").summary("EC2 operational commands").description("EC2 operational commands");
-  ec2.command("allow-ip").summary("Allow your current public IP for SSH on an EC2 security group").description(
-    "Update or create a named roaming SSH rule (port 22) for your current public IP on a chosen EC2 instance security group."
-  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option("-r, --region <region>", "AWS region").option(
-    "--rule-name <name>",
-    'SSH rule description (default: "{FirstName} Roaming")'
-  ).option("-v, --verbose", "Enable verbose logging").action(async (options) => {
-    await _WHGN5PZIcjs.allowIpCommand.call(void 0, {
-      profile: options.profile,
-      region: options.region,
-      ruleName: options.ruleName,
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-  const route53 = aws.command("route53").summary("Route53 DNS commands").description("Route53 DNS commands");
-  route53.command("add-record").summary("Interactively add or update a DNS record").description(
-    "Add or update a Route53 resource record set. Prompts for hosted zone, type, name, and value when not passed as flags. Shows whether the change creates, overwrites, or appends to an existing record."
-  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
-    "-z, --zone <name-or-id>",
-    "Hosted zone name or ID (e.g. mountaindev.com)"
-  ).option(
-    "-t, --type <type>",
-    "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)"
-  ).option(
-    "-n, --name <name>",
-    'Record name relative to the zone (e.g. "redline") or FQDN'
-  ).option("--value <value>", "Record value (e.g. CNAME target)").option(
-    "--ttl <seconds>",
-    "TTL in seconds (default: 300)",
-    (value) => Number.parseInt(value, 10)
-  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the change without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
-    await _WBOQ6AUNcjs.addRecordCommand.call(void 0, {
-      profile: options.profile,
-      zone: options.zone,
-      type: options.type,
-      name: options.name,
-      value: options.value,
-      ttl: options.ttl,
-      yes: _nullishCoalesce(options.yes, () => ( false)),
-      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-  route53.command("remove-record").summary("Interactively delete a DNS record").description(
-    "Delete a Route53 resource record set. Prompts for hosted zone, type, and name when not passed as flags, shows the record it found, and confirms before deleting."
-  ).option("-p, --profile <profile>", "AWS profile (defaults to AWS_PROFILE)").option(
-    "-z, --zone <name-or-id>",
-    "Hosted zone name or ID (e.g. mountaindev.com)"
-  ).option(
-    "-t, --type <type>",
-    "Record type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA)"
-  ).option(
-    "-n, --name <name>",
-    'Record name relative to the zone (e.g. "redline") or FQDN'
-  ).option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Preview the deletion without calling Route53").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
-    await _2FSYDFUVcjs.removeRecordCommand.call(void 0, {
-      profile: options.profile,
-      zone: options.zone,
-      type: options.type,
-      name: options.name,
-      yes: _nullishCoalesce(options.yes, () => ( false)),
-      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-  const ses = aws.command("ses").summary("SES operational commands").description("SES operational commands");
-  ses.command("send-email").summary("Send a test email via SES (API or SMTP)").description(
-    "Send a single test email through the SES API (default) or the SES SMTP endpoint."
-  ).requiredOption("--to <address>", "Recipient email address").requiredOption("--from <address>", "Verified SES sender email address").option("--subject <subject>", "Email subject line").option("--body <body>", "Email body (defaults to a timestamp and token)").option("--transport <api|smtp>", "Send via SES API or SES SMTP", "api").option("-r, --region <region>", "AWS region for SES", "us-east-1").option("-p, --profile <profile>", "AWS profile for api transport").option(
-    "--access-key-id <id>",
-    "IAM access key ID used as the SMTP username (smtp transport)"
-  ).option("--dry-run", "Print the email payload without sending").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
-    await _TKNNDDIBcjs.sendEmailCommand.call(void 0, {
-      to: options.to,
-      from: options.from,
-      subject: options.subject,
-      body: options.body,
-      transport: options.transport,
-      region: options.region,
-      profile: options.profile,
-      accessKeyId: options.accessKeyId,
-      dryRun: _nullishCoalesce(options.dryRun, () => ( false)),
-      verbose: _nullishCoalesce(options.verbose, () => ( false))
-    });
-  });
-}
-
-
-
-exports.registerAwsCommands = registerAwsCommands;

package/cjs/__chunks/B2KFW7T7.cjs

@@ -1 +0,0 @@
-"use strict";

package/cjs/__chunks/B5ENMOCD.cjs

@@ -1,288 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
-
-
-var _G5K4PVILcjs = require('./G5K4PVIL.cjs');
-
-
-var _R3GUC7O7cjs = require('./R3GUC7O7.cjs');
-
-// src/commands/aws/ec2/allow-ip/utils.js
-async function getCurrentPublicIp() {
-  const urls = ["https://checkip.amazonaws.com", "https://api.ipify.org"];
-  for (const url of urls) {
-    try {
-      const controller = new AbortController();
-      const timeout = setTimeout(() => controller.abort(), 8e3);
-      const response = await fetch(url, { signal: controller.signal });
-      clearTimeout(timeout);
-      if (!response.ok) continue;
-      const ip = (await response.text()).trim();
-      if (ip && ip.includes(".")) {
-        return ip;
-      }
-    } catch (e) {
-      continue;
-    }
-  }
-  throw new Error("Could not determine your current public IP address");
-}
-function listEnabledRegions(params) {
-  const { profile, region, verbose } = params;
-  const data = _R3GUC7O7cjs.runAws.call(void 0, {
-    profile,
-    region,
-    args: [
-      "ec2",
-      "describe-regions",
-      "--query",
-      "Regions[?OptInStatus!=`not-opted-in`].RegionName"
-    ],
-    verbose
-  });
-  const regions = Array.isArray(data) ? data : [];
-  return regions.map((value) => String(value)).sort();
-}
-function listInstances(params) {
-  const { profile, region, verbose } = params;
-  const data = _R3GUC7O7cjs.runAws.call(void 0, {
-    profile,
-    region,
-    args: ["ec2", "describe-instances"],
-    verbose
-  });
-  const instances = [];
-  for (const reservation of _nullishCoalesce(data.Reservations, () => ( []))) {
-    for (const raw of _nullishCoalesce(reservation.Instances, () => ( []))) {
-      const state = _nullishCoalesce(_optionalChain([raw, 'access', _ => _.State, 'optionalAccess', _2 => _2.Name]), () => ( "unknown"));
-      if (state === "terminated" || state === "shutting-down") {
-        continue;
-      }
-      let name = "";
-      for (const tag of _nullishCoalesce(raw.Tags, () => ( []))) {
-        if (tag.Key === "Name") {
-          name = _nullishCoalesce(tag.Value, () => ( ""));
-          break;
-        }
-      }
-      const securityGroupIds = (_nullishCoalesce(raw.SecurityGroups, () => ( []))).map((group) => group.GroupId).filter((id) => Boolean(id));
-      instances.push({
-        instanceId: raw.InstanceId,
-        name,
-        state,
-        instanceType: _nullishCoalesce(raw.InstanceType, () => ( "unknown")),
-        publicIp: _nullishCoalesce(raw.PublicIpAddress, () => ( null)),
-        securityGroupIds
-      });
-    }
-  }
-  instances.sort(
-    (a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()) || a.instanceId.localeCompare(b.instanceId)
-  );
-  return instances;
-}
-function describeSecurityGroups(params) {
-  const { profile, region, groupIds, verbose } = params;
-  if (groupIds.length === 0) {
-    return [];
-  }
-  const data = _R3GUC7O7cjs.runAws.call(void 0, {
-    profile,
-    region,
-    args: ["ec2", "describe-security-groups", "--group-ids", ...groupIds],
-    verbose
-  });
-  const groups = (_nullishCoalesce(data.SecurityGroups, () => ( []))).map((raw) => ({
-    groupId: raw.GroupId,
-    groupName: _nullishCoalesce(raw.GroupName, () => ( "")),
-    description: _nullishCoalesce(raw.Description, () => ( ""))
-  }));
-  groups.sort((a, b) => a.groupName.localeCompare(b.groupName));
-  return groups;
-}
-function getSecurityGroupDetails(params) {
-  const { profile, region, groupId, verbose } = params;
-  const data = _R3GUC7O7cjs.runAws.call(void 0, {
-    profile,
-    region,
-    args: ["ec2", "describe-security-groups", "--group-ids", groupId],
-    verbose
-  });
-  const securityGroups = _nullishCoalesce(data.SecurityGroups, () => ( []));
-  if (securityGroups.length === 0) {
-    return null;
-  }
-  return securityGroups[0];
-}
-function isSingleHostCidr(cidrIp) {
-  return cidrIp.endsWith("/32") && cidrIp !== "0.0.0.0/0";
-}
-function portAllowsSsh(permission) {
-  const protocol = permission.IpProtocol;
-  if (protocol !== "tcp" && protocol !== "6") {
-    return false;
-  }
-  const fromPort = permission.FromPort;
-  const toPort = permission.ToPort;
-  if (fromPort === void 0 && toPort === void 0) {
-    return true;
-  }
-  if (fromPort === void 0 || toPort === void 0) {
-    return false;
-  }
-  return fromPort <= _G5K4PVILcjs.SSH_PORT && _G5K4PVILcjs.SSH_PORT <= toPort;
-}
-function listSshIngressRules(securityGroup) {
-  const rules = [];
-  for (const permission of _nullishCoalesce(securityGroup.IpPermissions, () => ( []))) {
-    if (!portAllowsSsh(permission)) {
-      continue;
-    }
-    const fromPort = _nullishCoalesce(permission.FromPort, () => ( _G5K4PVILcjs.SSH_PORT));
-    const toPort = _nullishCoalesce(permission.ToPort, () => ( _G5K4PVILcjs.SSH_PORT));
-    const ipProtocol = _nullishCoalesce(permission.IpProtocol, () => ( "tcp"));
-    for (const ipRange of _nullishCoalesce(permission.IpRanges, () => ( []))) {
-      const cidrIp = ipRange.CidrIp;
-      if (!cidrIp || !isSingleHostCidr(cidrIp)) {
-        continue;
-      }
-      rules.push({
-        cidrIp,
-        description: _nullishCoalesce(ipRange.Description, () => ( "")),
-        fromPort,
-        toPort,
-        ipProtocol
-      });
-    }
-  }
-  return rules;
-}
-function extractRoamingFirstName(params) {
-  const { profile, identity } = params;
-  const arn = _nullishCoalesce(identity.Arn, () => ( ""));
-  const username = arn.includes("/") ? _nullishCoalesce(arn.split("/").pop(), () => ( "")) : "";
-  for (const candidate of [username, _nullishCoalesce(profile, () => ( ""))]) {
-    if (!candidate) continue;
-    const match = /^md-([^-]+)-/.exec(candidate);
-    if (match && match[1]) {
-      return match[1].charAt(0).toUpperCase() + match[1].slice(1).toLowerCase();
-    }
-  }
-  return _G5K4PVILcjs.DEFAULT_ROAMING_NAME;
-}
-function roamingRuleDescription(firstName) {
-  return `${firstName} Roaming`;
-}
-function resolveRoamingRule(sshRules, ruleDescription) {
-  const target = ruleDescription.toLowerCase();
-  for (const rule of sshRules) {
-    if (rule.description.trim().toLowerCase() === target) {
-      return rule;
-    }
-  }
-  return null;
-}
-function ruleAlreadyAllowsIp(sshRules, newCidr) {
-  for (const rule of sshRules) {
-    if (rule.cidrIp === newCidr) {
-      return rule;
-    }
-  }
-  return null;
-}
-function buildIpPermissions(params) {
-  const {
-    cidrIp,
-    description,
-    fromPort = _G5K4PVILcjs.SSH_PORT,
-    toPort = _G5K4PVILcjs.SSH_PORT,
-    ipProtocol = "tcp"
-  } = params;
-  return JSON.stringify([
-    {
-      IpProtocol: ipProtocol,
-      FromPort: fromPort,
-      ToPort: toPort,
-      IpRanges: [{ CidrIp: cidrIp, Description: description }]
-    }
-  ]);
-}
-function authorizeRule(params) {
-  const { profile, region, groupId, verbose, ...rule } = params;
-  _R3GUC7O7cjs.runAws.call(void 0, {
-    profile,
-    region,
-    args: [
-      "ec2",
-      "authorize-security-group-ingress",
-      "--group-id",
-      groupId,
-      "--ip-permissions",
-      buildIpPermissions(rule)
-    ],
-    expectJson: false,
-    verbose
-  });
-}
-function revokeRule(params) {
-  const { profile, region, groupId, rule, verbose } = params;
-  _R3GUC7O7cjs.runAws.call(void 0, {
-    profile,
-    region,
-    args: [
-      "ec2",
-      "revoke-security-group-ingress",
-      "--group-id",
-      groupId,
-      "--ip-permissions",
-      buildIpPermissions({
-        cidrIp: rule.cidrIp,
-        description: rule.description,
-        fromPort: rule.fromPort,
-        toPort: rule.toPort,
-        ipProtocol: rule.ipProtocol
-      })
-    ],
-    expectJson: false,
-    verbose
-  });
-}
-function instanceLabel(instance) {
-  const publicIp = instance.publicIp || "no public IP";
-  const name = instance.name || "(no name)";
-  return `${instance.instanceId}  ${name}  ${instance.state}  ${instance.instanceType}  ${publicIp}`;
-}
-function securityGroupLabel(group) {
-  return `${group.groupId}  ${group.groupName}  ${group.description}`;
-}
-function sshRuleLabel(rule) {
-  const description = rule.description || "(no description)";
-  return `${rule.cidrIp}  ${description}`;
-}
-function printSshRules(sshRules, log = console.log) {
-  if (sshRules.length === 0) {
-    log("  (no single-host SSH rules on port 22)");
-    return;
-  }
-  for (const rule of sshRules) {
-    log(`  - ${sshRuleLabel(rule)}`);
-  }
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-exports.getCurrentPublicIp = getCurrentPublicIp; exports.listEnabledRegions = listEnabledRegions; exports.listInstances = listInstances; exports.describeSecurityGroups = describeSecurityGroups; exports.getSecurityGroupDetails = getSecurityGroupDetails; exports.listSshIngressRules = listSshIngressRules; exports.extractRoamingFirstName = extractRoamingFirstName; exports.roamingRuleDescription = roamingRuleDescription; exports.resolveRoamingRule = resolveRoamingRule; exports.ruleAlreadyAllowsIp = ruleAlreadyAllowsIp; exports.authorizeRule = authorizeRule; exports.revokeRule = revokeRule; exports.instanceLabel = instanceLabel; exports.securityGroupLabel = securityGroupLabel; exports.sshRuleLabel = sshRuleLabel; exports.printSshRules = printSshRules;